Qu1cksc0pe

All-in-One malware analysis tool for analyze many file types, from Windows binaries to E-Mail files.

You can get:

• What DLL files are used.
• Functions and APIs.
• Sections and segments.
• URLs, IP addresses and emails.
• Android permissions (Dangerous/Special/Info).
• MITRE ATT&CK mappings (Windows + Linux static analysis).
• File extensions and their names.
• Embedded executables/exploits. And so on...

Qu1cksc0pe aims to get even more information about suspicious files and helps user realize what that file is capable of.

Qu1cksc0pe Can Analyze Currently

Files	Analysis Type
Windows Executables (.exe, .dll, .msi, .bin)	Static, Dynamic
Linux Executables (.elf, .bin)	Static, Dynamic
MacOS Executables (mach-o)	Static
Android Files (.apk, .jar, .dex)	Static, Dynamic(for now .apk only)
Golang Binaries (Linux)	Static
Document Files	Static; sandboxed VBA behavior emulation when macros are present
VBScript/VBA Family (.vbs, .vbe, .vba, .vb, .bas, .cls, .frm)	Static + sandboxed behavior emulation (--docs)
AppleScript Source (.applescript, including content detected under misleading VB-family extensions)	Static (--analyze)
HTML Documents (.html, .htm)	Static + isolated inline JavaScript behavior emulation (--analyze)
JavaScript (.js)	Static + isolated behavior emulation (--analyze)
HTA / HTML Application (.hta)	Static + isolated JScript behavior emulation (--analyze)
Windows Batch Scripts (.bat, .cmd, including content detected under misleading VB-family extensions)	Static (--analyze)
Windows Shortcut (.lnk)	Static (--analyze)
Archive Files (.zip, .rar, .ace)	Static
PCAP Files (.pcap)	Static
PowerShell Scripts (.ps1, .PS1)	Static + bounded in-memory behavior emulation (--analyze)
E-Mail Files (.eml)	Static

MCP Server

Qu1cksc0pe ships an MCP server (Modules/mcp_server.py) that exposes its static-analysis features as tools for MCP-aware clients (Claude Code, Claude Desktop, etc.). It shells out to qu1cksc0pe.py the same way the Web UI does, so it needs no code changes to stay in sync with the CLI, and it only imports the mcp package itself at startup (the individual analyzers' own dependencies are only needed once a tool actually runs).

Install the extra dependency (already included in requirements.txt):

pip install "mcp>=2.0.0"

Launch it through the --mcp flag, same as every other Qu1cksc0pe command:

python3 qu1cksc0pe.py --mcp

Transport defaults to streamable-http (binds 127.0.0.1:8765/mcp), so the server is a persistent process any number of clients can attach to and detach from independently -- run it once in its own terminal, point clients at http://127.0.0.1:8765/mcp. Override with:

SC0PE_MCP_TRANSPORT=stdio python3 qu1cksc0pe.py --mcp   # traditional one-client-per-process model

Env var	Default
SC0PE_MCP_TRANSPORT	streamable-http	streamable-http, stdio, or sse.
SC0PE_MCP_HOST	127.0.0.1	Bind address for streamable-http/sse.
SC0PE_MCP_PORT	8765	Bind port for streamable-http/sse.
SC0PE_MCP_HTTP_PATH	/mcp	URL path for streamable-http.

A project-level .mcp.json is included so Claude Code picks the server up automatically for this repo. It pins stdio explicitly (via env), since Claude Code spawns and owns a fresh process per session rather than attaching to one you started yourself:

{
  "mcpServers": {
    "qu1cksc0pe": {
      "command": "python3",
      "args": ["qu1cksc0pe.py", "--mcp"],
      "env": { "SC0PE_MCP_TRANSPORT": "stdio" }
    }
  }
}

If python3 on your PATH isn't the interpreter with Qu1cksc0pe's dependencies installed (common on Windows, or with multiple Python installs), change command to the full path of the right python/python.exe, or run python3 -c "import mcp" first to check.

Tools: analyze_file, analyze_document, analyze_archive, detect_packer, detect_language, extract_iocs, check_resources, check_signatures, scan_hash, scan_virustotal, configure_virustotal_api_key, configure_ai_api_key, update_hash_database, list_supported_file_types. Each tool validates its input file/folder locally (rejecting files >= 50MB, since the CLI would otherwise prompt interactively) before invoking the CLI, and returns the resulting JSON report(s) plus captured console output. Interactive-only features (--watch dynamic analysis, --ui, --install) are intentionally not exposed as tools.

The five analysis tools that support ai=True also take an ai_provider argument ("auto"/"ollama" (default, local), "claude", "openai", "deepseek", "kimi", or "glm") -- see AI Analysis Providers below. Configure a cloud key first with configure_ai_api_key(provider="claude", api_key="...") (or whichever provider).

Logs: every tool call and CLI dispatch (command, duration, exit code, reports collected) is logged to stderr and to sc0pe_reports/mcp/mcp_server.log. Set SC0PE_MCP_LOG_LEVEL=DEBUG for full stderr output too, or SC0PE_MCP_LOG_FILE=0 to disable the file sink.

AI Analysis Providers

--ai (and the MCP tools' ai=True) summarizes a generated report with an LLM. Ollama (local) is the default; five cloud backends are also supported.

Provider	Flag/value	Env var
Ollama (default)	auto or ollama	OLLAMA_HOST
Claude (Anthropic)	claude	ANTHROPIC_API_KEY
OpenAI	openai	OPENAI_API_KEY
DeepSeek	deepseek	DEEPSEEK_API_KEY
Kimi (Moonshot AI)	kimi	MOONSHOT_API_KEY
GLM (Zhipu AI)	glm	ZHIPUAI_API_KEY

Ollama needs no key -- install Ollama and select the model via [Ollama] model in Systems/Multiple/multiple.conf. For a cloud provi